C**** COBIT - isaca.nl · PDF file•COBIT 5 provides a comprehensive framework ... ITRG 04 Managed IT-related business risk ITRG 10 Security of information, processing infrastructure

C**** COBIT

Nootdorp

1

2

APMG accredited

APMG accredited Cobit Independent Trainer

3

COBIT5

• COBIT5 =

4

Business Proces

IT services en infrastructuur

5

•

6

•

7

GEIT

COBIT® beantwoord belangrijke bedrijfsvragen

Is mijn informatie technologie organisatie de juiste dingen aan het doen?

Doen we de dingen op de juiste manier?

Krijgen we de dingen voor elkaar?

Zien we de resultaten wel goed?

* Based on the “Four Ares” as described by John Thorp in his book The Information Paradox, written jointly with Fujitsu, first published

in 1998 and revised in 2003

Business Proces

IT services en infrastructuur

Leunen op IT

COBIT® Business voordelen

• COBIT® geeft inzicht aan executive management om governance uit te voeren over de IT in het bedrijf

• Effectievere wegen om de IT de bedrijfsdoelen te laten ondersteunen

• Meer transparantie en voorspelbare IT kosten over de

hele life-cycle

• Meer informatie over IT die betrouwbaar en op tijd is

• Hogere kwaliteit uit IT services en meer succesvolle projecten

• Effectiever management van IT-gerelateerde risico’s

Stakeholder Value • Delivering enterprise stakeholder value requires

good governance and management of information and technology (IT) assets.

• Enterprise boards, executives and management have to embrace IT like any other significant part of the business.

• External legal, regulatory and contractual compliance requirements related to enterprise use of information and technology are increasing, threatening value if breached.

• COBIT 5 provides a comprehensive framework that assists enterprises to achieve their goals and deliver value through effective governance and management of enterprise IT

12

Overview COBIT5

• 5 Principles

• 7 Enablers

• Process Reference Model

• Life Cycle model voor Implementation

• Process Assessment Model

• Dimensies

13

Governance of Enterprise IT

COBIT 5

IT Governance

COBIT4.0/4.1

Management

COBIT3

Control

COBIT2

Audit

COBIT1

2005/7 2000 1998

Evo

luti

on

1996 2012

Val IT 2.0 (2008)

Risk IT (2009)

BMIS (2010)

The Evolution of COBIT 5

14

© 2012 ISACA. All Rights Reserved.

Meeting Stakeholder Needs

Principle 1. Meeting Stakeholder Needs

• Enterprises exist to create value for their stakeholders

16

Regulators

ISO

Auditors

Laws

Waar begint COBIT5 ?

• EERST moet een bedrijf zijn doelen gesteld hebben

• Hoe bemoeit COBIT zich niet mee

• SWOT, COSO, BSC, ERM, DMW, JFW

• Stakeholder analyse !

• Doelen

• En dan … Governance, supported by COBIT5

17

Daar begint COBIT5 !

• Uw bedrijf heeft zijn doelen gesteld en wil ze goed in beeld houden

• Doelen zijn altijd in beweging…

• Regelmatige Stakeholder analyse !

• Vertaling van Stakeholder needs naar Doelen naar IT gerelateerde doelen en naar Enabling doelen en weer terug en dat is Governance, supported by COBIT5 !

18

COBIT5 Goals Cascade



COBIT5 Goals Cascade +

Balanced Scorecard

Enterprise Goals

IT Related Goal (ITRG) COBIT Process

Financial

Customer

Internal

Learning

Customer

6. Customer-oriented service culture

7. Business service continuity and availability

8. Agile responses to a changing business environment

9. Information-based strategic decision making

10. Optimisation of service delivery costs

Start met de BSC categorie in stap 1

© 2012 ISACA. All rights reserved.

21

Figure 24—Mapping COBIT 5 Enterprise Goals to Governance and Management Questions

Stap 1 Appendix D Stakeholder Needs en BSC dimensies

Cascade stap 1 Figure5: BSC dimensies en Enterprise Goals plotten op BRR

Customer



ITRG 07 Delivery of IT services in line with business requirements

ITRG 08 Adequate use of applications, information and technology solutions

ITRG 01 Alignment of IT and business strategy

ITRG 04 Managed IT-related business risk

ITRG 10 Security of information, processing infrastructure and applications

ITRG 14 Availability of reliable and useful information for decision making

PROCESSES PRIMARY IMPORTANCE OR

IMPACT

APO09 Manage Service Agreements P

APO13 Manage Security P

BAI04 Manage Availability and Capacity P

BAI08 Manage Knowledge P

BAI10 Manage Configuration P

DSS03 Manage Problems P

DSS04 Manage Continuity P

Stap 2 – Selecteer Enterprise Goal, IT related Goals en Processen


24

Enterprise Goals To IT Related Goals There are also 17 generic IT related goals as shown in Figure 6 (shown below) that are also categorised into the Balanced Score Card (BSC) categories. The relationship of enterprise goals to IT related Goals are shown in Appendix B Figure 22 page 50

Figure 22—Mapping COBIT 5 Enterprise Goals to IT-related Goals

Stap 2 Appendix B Enterprise Goals naar IT Related Goals in BSC dimensies

Customer



ITRG 07 Delivery of IT services in line with business requirements

ITRG 08 Adequate use of applications, information and technology solutions

ITRG 01 Alignment of IT and business strategy

ITRG 04 Managed IT-related business risk

ITRG 10 Security of information, processing infrastructure and applications

ITRG 14 Availability of reliable and useful information for decision making

PROCESSES PRIMARY IMPORTANCE OR

IMPACT

APO09 Manage Service Agreements P

APO13 Manage Security P

BAI04 Manage Availability and Capacity P

BAI08 Manage Knowledge P

BAI10 Manage Configuration P

DSS03 Manage Problems P

DSS04 Manage Continuity P

Stap 2 – het laatste deel: de processen


27

Figure 23—Mapping COBIT 5 IT-related Goals to Processes (cont.)

Stap 2 Appendix C IT Related Goals naar processen

Step .3

Process ID APO09

Process Name Manage Service Agreements

Process Description

Align IT-enabled services and service levels with enterprise needs and expectations, including identification, specification, design, publishing, agreement, and monitoring of IT services, service levels and performance indicators.

Process Purpose Ensure that IT services and service levels meet current and future enterprise needs.

Outcomes (OS)

Number Description

APO09-O1 IT services are identified, defined and catalogued according to enterprise needs.

APO09-O2 Service agreements reflect enterprise needs and the capabilities of IT.

APO09-O3 IT services perform as stipulated in service agreements.

Example APO09 – Examine Metrics

RELATED METRICS

The number of business processes with unidentified service

agreements

% of live IT services covered by service Agreements

% of Customers satisfied that service delivery meets agreed-on

levels

Number & severity of service breaches

% of services being monitored to service levels

% of service targets being met


29

Concepts – CSF to Measurement

30 © Crown copyright 2011. Reproduced under license from Axelos.

Figure 4.1 Continual Service Improvement, page 50

Van Visie naar meten

31

Een voorbeeld van Governance en doelen

32

Heeft u vragen (tot zover) over het omzetten van uw bedrijfsdoelen naar ….. processen ?


COBIT 5 Principles

© 2012 ISACA All rights reserved.

33

COBIT 5 Mapping Summary


35

Key components of a governance system


36

Governing Body

37

control is important especially when you don’t have it!

COBIT 5 Process Reference Model


The COBIT5 Enterprise Enablers


COBIT 5 Implementation Life Cycle


• Manage before you can Govern

• Controls are needed

• Stakeholders must be involved

• IT helps the enterprise

• Organizations are helped to find out what they

really want

My view on Governance Of Enterprise IT with COBIT5

41

42

“All Models are wrong,

but some are useful” George Box

afterthought

Thank you ! Erik van Eeden 43

Documents

C**** COBIT - isaca.nl · PDF file•COBIT 5 provides a comprehensive framework ... ITRG 04 Managed IT-related business risk ITRG 10 Security of information, processing infrastructure